CVE-2008-0736
CandyPress 4.1.1.26 - Path Exposure via FedExAccount Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-0736. PoCs published by BugReport.IR.
AI-analyzed exploit summary The exploit demonstrates SQL injection, XSS, and path disclosure vulnerabilities in CandyPress eCommerce suite version 4.1.1.26. It includes functional PoC URLs to extract sensitive data such as admin credentials, payment details, and configuration settings.
Description
admin/SA_shipFedExMeter.asp in CandyPress (CP) 4.1.1.26, and possibly other 4.x and 3.x versions, allows remote attackers to obtain the path via a certain value of the FedExAccount parameter.
Exploits (1)
The exploit demonstrates SQL injection, XSS, and path disclosure vulnerabilities in CandyPress eCommerce suite version 4.1.1.26. It includes functional PoC URLs to extract sensitive data such as admin credentials, payment details, and configuration settings.